Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- It is crazy that wasn't something already required. Here local sms-gateways always required paperwork to prove word you want to use as sender name is a brand you own.by mDyJzDPmBdG
- I am sure there are reasons why this won't work, but could it really be so hard to show both the faked number, and where the call actually comes from, so I could choose which one to add to my block list.
- India has something similar, and even goes a step further by having last alphabet as an identifier for Promotional, Services, Govt. etc.by n2h4
- I've gotten like five notifications from Telstra about this today. They really want me to know that things might change! Like I don't already get a few spam calls and messages every dayby sevenseacat
- Sadly this isn't limited to Australia. RCS the SMS successor does not consider free peering. I believe security is used as an excuse to create a closed ecosystem that surfaces new businesses and therefore innovation.
For a community of builders, like this, any barrier to entry will be problem, however we'll intend.
by codingjoe - Good move, it's crazy how many scam calls and SMS I receive in Australia. In fact, if I get an SMS or a call, I just assume it's a scam.by a_bonobo
- I don’t think this will cut down on spam so much as fraud. All spam calls I get don’t have registered IDs
- Have you added yourself to the Do Not Call register?by justinclift
- The 'Ask Reason for Calling' iPhone feature has completely eliminated scam calls for me. Real callers not in contacts leave a short message and I pick it up. Best iOS feature from the last few years IMO.by gravelc
- I welcome this move, enforcing that SMS messages come from who they say they'll come from is important.
Personally I think the whole system of replacing the point of origin with a name needs to be overhauled. Allowing a name as well is fine, but the practice of delivering messages that can't be replied to is pretty poor.
Rather than have to futz around with a different number or website to go to, I should be able to just reply "STOP" if (for example) Dominos keep spamming me with Pizza offers I don't want.
by Nursie - In India this has been the regulation for several years, and has helped along with the Do Not Disturb (DND) registration by the end user and rules for senders/callers. Anyone sending bulk SMSes, even if the sending is done through a third party provider like AWS from another country/region, will have to register. [1]
The entity, the header, content template (which allows two or three variables/placeholders) need to be registered. A Distributed Ledger (DLT) is used to store these. Ad hoc messages without a registered template are expected to be rejected by the telco.
by wtmt - As an Australian who moved to India a couple of years ago: I’ve found India’s Do Not Call Register significantly less effective than Australia’s, because telco, ISP, TRAI and other government offices keep on sending spam, a lot of it stuff that will train people to be phished, and if you report them as DND violations, they declare them service-related. And for telco/ISP, they commingle with actual service-related and important transactional messages, so you can’t just block the shortcodes.
In Australia, I don’t remember ever really getting spam SMSes. Emails from the bank, yes, but that’s easier to filter if desired. When you get the same old spam messages time after time, you can filter them in email, but text message apps are often not up to that sort of thing.
The really stupid thing is that more than half of the spam is about blocking spam. At least once a month, AD-TRAIND-G sends:
> స్పామర్లపై చర్య కోసం స్పామ్ను రిపోర్ట్ చెయ్యండి. అయితే, ఫోన్ కాలింగ్ యాప్లో స్పామర్ను బ్లాక్ చేయడం వల్ల స్పామర్పై చర్య తీసుకోబడదు. స్పామ్ను TRAI DND యాప్ లేదా సర్వీస్ ప్రొవైడర్ యాప్ లేదా 1909 లో రిపోర్ట్ చెయ్యండి. TRAI DND యాప్లో రిపోర్ట్ చేయడం సులభం మరియు వేగవంతం, ఈరోజే ఇన్స్టాల్ చేసుకోండి.
And AD-AIRDOT-S just sends a random message from a pool of half a dozen or so, mostly English but one or two Telugu, sometimes every few days, sometimes every few weeks. Such as:
> Alert: On receiving unwanted SMS , please complain by calling 1909 or send SMS to 1909 in format 'SMS Content, Sender No, dd/mm/yy' or visit bit.ly/2qBK0vp to report through Airtel Thanks App.
(Huh, that link is now broken. Used to work. Makes it even more dumb.)
I should automate reporting all of this stuff, deliberately to waste their time, and maybe, just maybe, make someone think, “maybe we should stop sending this stuff”.
There was also RCS… I turned that off after a bit, because it was being used purely for spam and undesirable stuff, and you couldn’t complain in the same channels. RCS is dead like this.
by chrismorgan - And as we can see from Australia, this doesn’t need a blockchain.by captn3m0
- Singapore does this. Any message that comes from an unregistered sender show up on the phone with “Likely Scam” as the sender name.by JSR_FDED
- The Australian one will label them as Unverified.
Personally, I'd prefer them to be blocked. If it's important and legitimate, they'll register.
by steve_taylor - As counter measure to text scams the Australian government (actually ACMA which I think is the Au version of the FCC) has introduced a national register of Sender Ids, which comes in to effect on the 1st of July. It requires providers to mark any unregistered Sender Id as 'Unverified'
I haven't yet been able to find the full register (if it's even public) but I thought this is an interesting approach.
by anitil - As an Australian, I'm happy to hear this, but also annoyed that a lot of legitimate SMS from companies don't use branded sender ID. I'm not sure why, but my guess is that SMS gateways charge more for it and businesses don't want to pay the extra cent or two.by steve_taylor
- That will likely change after this goes into effect, otherwise all that legitimate spam will never make it.by ehnto
- No it costs the same, the reason they do it is that it’s slightly more difficult to spoof a real number sender ID because most gateways will verify ownership by sending you a text on that number before letting you send outbound from it, where as they have no way of doing the same for an alphanumeric sender IDby dools
- Alpha codes don't allow replies. As such if you need to reply it has to be from a numberby ticoombs
- I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs.
I'm assuming there's a technical and/or willpower reason or some counterfactual like VOIP depends on it.
Even just flagging it would help. Or, rejecting numbers they can know lie inside their own routing architecture, or asserts within their own number plan where the CLID does not match.
Morally it's like BCP38 in the customer facing internet systems: reject customer input they don't pay you to assert.
by ggm - I rely on the ability to set the outbound caller ID but I would happily register it if required.by dools
- Cost. Cost to spam and scam tends to 0 at industrial scale. Meanwhile amount of time and resources telco want to spend on fighting it is Bounded by how much regulators are going to allow them to pass on to customers.by bxk76
- > Even just flagging it would help.
That's what's mandated by ARCEP (the French regulator) since the beginning of this year, and now all faked numbers are marked as “hidden caller”, and indeed it helps a lot.
by stymaar - Telco networks are sprawling and accurately defining the boundary might be harder than it sounds.
Traditionally they have a bias towards "working"/delivering traffic. It's easier to issue a refund than answer a urgent support request.
I can also imagine the biggest customers have all sorts of multi-vendor failover plans that may be affected.
by fowl2 - > I've yet to read a good explanation of why the telcos permit ...
They (the telcos) are paid for every message they deliver. So absent regulation forcing them to do otherwise, it is in their best interest (additional profit) to pass through every message with no filtering of any form.
And, if the regulators had any technical knowledge at all, they would recognize that the billing system is the key to stopping the robo texts. Every text can be traced back to its origin through the billing system (because that's how the telco's collect their fees, so of course they know who to collect from for which messages they forwarded). So the regulators just need to force open the billing systems and trace the money back to the illicit senders, and then they know who to cut off (or to fine out of existence).
by pwg - > I've yet to read a good explanation of why the telcos permit CLID faking and reinjection of apparently local CLID by overseas inputs.
Actually, there are several legitimate use cases:
• Call divert: Local number calls a number abroad and that one is diverted back a another local number. It's probably rare, but it's a totally legit use case.
• 2G/3G roaming: I'm not an expert on this one, but as far as I understood it, roaming calls placed on 2G/3G networks are initiated in the visiting country, and use the local number of the caller.
• Getting better rates using VoIP. Whether this is legit or not might be subject to discussion, however I was using a foreign VoIP provider (because they had better rates for local calls than any local providers, for my low call volume) sending out my own local number (had to be validated by them by callback, although that's their own security measure, not the network's one). Now in several EU countries and Switzerland this doesn't work any more, as calls bearing national IDs coming from abroad must be displayed as anonymous. And it's quite annoying that there isn't a way to "authentify" those numbers so the owner can use them as they wish.
by ale42 - That's why in 2020 the FCC belatedly mandated SHAKEN/STIR to authenticate Caller ID in the US using public-key cryptography. Deployment is still work in progress, and it does not cover SMS/MMS, however.
A bigger problem is Russia or Saudi Arabia using the SS7 signalling network to track their dissidents in the US because those legacy telco protocols have basically no authentication whatsoever, and won't blink if a Saudi Telco sends Verizon a MAP message saying "what is the cell location of Jamal Khashoggi's phone?"
by fmajid - I used to work at two (UK) telcos. There's a historic reason and a modern reason.
The historic reason was, just like the Internet, the international phone network was built on gentlemen agreements by engineers who largely trusted each other.
A big national telco is unlikely to attack its peers, so there was little need for safety measures. As smaller telcos came in to the mix via deregulation, that understanding changed - but it was hard to retroactively fit controls.
The more modern reason is outsourced call centres. You want outbound calls from your Philippines based staff to show as if they were calling from a local number. When large and reputable entities were doing this it was fine. Just like showing a different reply-to address on an email.
If you were designing a modern network, it wouldn't be like this. But international telephony is over a hundred years old and has a huge amount of legacy technology and legal agreements.
by edent